VPC-native security, verifiable by designVPC 原生安全，每一份结论都可验证

Data stays in your VPC.
Every verdict is independently verifiable. 数据留在您的 VPC，
每一条结论都可独立验证。

An unprivileged agent scans cloud configuration, IaC and AI runtime inside your network. Only rule_id / status / detail / resource_hash leaves — never the payload. 无特权 Agent 在您的网络内扫描云配置、IaC 与 AI 运行时。仅上传 rule_id / status / detail / resource_hash 四元组，绝不上传原始载荷。

Start a local scan开始本地扫描 See the proof path查看证明链路

No root无需 Root
No eBPF无需 eBPF
No code write access无代码写权限

Verdict envelope结论信封Illustrative schema · not a live verdict字段示例 · 非实时结论

Schema格式

rule_id<rule-id>

status<PASS | FAIL | BLOCK>

detail<redacted-detail>

resource_hash<sha256-resource-hash>

Ed25519 evidenceEd25519 证据append-only ledger追加式账本

SHA-256

⌁Payload never leaves载荷不出域Processed in memory全程内存处理

◎Offline verification离线可验Public key only仅需公钥

Proof path证明链路

Trust is a technical property.信任，应该由技术证明。

No black box, no “trust us”. Three inspectable steps connect a local decision to an evidence packet your auditor can verify offline.没有黑盒，也不需要“相信我们”。三个可检查的步骤，把本地判定连接到审计师可离线验证的证据包。

⌂

Scan locally本地扫描

The agent evaluates configuration, IaC and runtime actions inside your VPC.Agent 在您的 VPC 内评估配置、IaC 与运行时动作。

◇

Emit only the verdict只发送结论

Payloads stay local. The control plane receives the four-tuple and nothing else.载荷留在本地，控制面仅接收四元组，不接收其他内容。

✓

Seal the evidence封存证据

Every result enters a hash-linked, Ed25519-signed ledger for independent review.每条结果进入哈希链式、Ed25519 签名的账本，供独立复核。

One control plane统一控制面

Security that fits the workflow.融入工作流的安全。

From the first pre-flight scan to a verifiable evidence pack, AegisZero keeps the heavy work close to your data.从首次预检到可验证的证据包，AegisZero 把核心计算留在数据身边。

Explore the console探索控制台

⌘

Zero-data VPC agent零数据出域 Agent

Unprivileged, read-only ingestion with signed rules and no inbound access.无特权、只读采集，规则验签下发，无需开放入站访问。

Local by default默认本地运行

◈

AI runtime guardrailsAI 运行时护栏

Evaluate tool calls before execution and preserve a verifiable decision trail.在工具执行前评估调用，并保留可验证的决策轨迹。

WASM isolatedWASM 隔离

▤

Verifiable evidence可验证证据

Export evidence with public-key verification and a shareable trust badge.导出带公钥验证的证据，并生成可分享的信任徽章。

Auditor ready面向审计

↗

Fix Arsenal修复库

Review precise patches and PR findings without granting code write access.查看精确补丁与 PR 结论，无需授予代码写权限。

Human approved人工确认

Control coverage控制项覆盖

Start where the evidence matters most.从最关键证据开始。

SOC 2PCI DSSISO 27001AI governanceAI 治理

Control workflows are configurable during onboarding. AegisZero does not imply certification or auditor endorsement.控制项工作流可在接入时配置。AegisZero 不暗示已取得认证或获得审计机构背书。

Clear boundaries明确边界

We deliberately leave things out.有些事，我们刻意不做。

Security products earn trust by being precise about what they do not do. These are product boundaries, not temporary gaps.安全产品靠清晰说明“不做什么”赢得信任。这些是产品边界，不是临时缺口。

×eBPFNo kernel instrumentation不进行内核插桩

×RootNo privileged container不使用特权容器

×Code write代码写权限No repository write access不申请仓库写权限

×ZK theatre零知识证明包装No unnecessary proof wrapper不做无必要的证明包装

Ready when you are随时开始

Keep the data.
Prove the outcome.数据留下，
结果可证。

Start with a local scan. Nothing leaves your VPC until you decide it should.从一次本地扫描开始。在您决定之前，什么都不会离开 VPC。

Open AegisZero进入 AegisZero

Data stays in your VPC.Every verdict is independently verifiable. 数据留在您的 VPC，每一条结论都可独立验证。